{"id":"CVE-2026-53964","revision":"bd1ad84ea0bc40879b9cfae5554abdf7","records":[{"revision":"bd1ad84ea0bc40879b9cfae5554abdf7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53964","aliases":[],"title":"Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)","description":"Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.","state":0,"publishedAt":"2026-10-01T19:55:07.504+00:00","modifiedAt":"2026-10-01T20:13:16.003+00:00","affected":[{"ecosystem":"Vendor product","name":"document-merge-service","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"adfinis\",\n                    \"product\": \"document-merge-service\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 9.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2,"severity":"HIGH"}],"references":["https://github.com/adfinis/document-merge-service/security/advisories/GHSA-w47q-945m-q9pc","https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53964","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53964","identifiers":["CVE-2026-53964"]},"retained":false,"historicalAffected":[]}],"coverage":[]}